XDR-Engineer Ingestion And Automation Practice Test 2 — 15 Questions

Question 1

An administrator is configuring a Cortex XDR data forwarding rule to send only alerts with a severity of 'High' or 'Critical' to a third-party SIEM. The SIEM expects alerts in JSON format over syslog. Which configuration should the administrator apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a data forwarding rule with a filter for severity >= High and set the format to JSON over syslog.. The correct approach is to use a Cortex XDR data forwarding rule with a severity filter and JSON over syslog format. This native feature allows precise filtering and formatting. API scripting is custom and not the intended method, pulling from SIEM is not supported, and Broker VM is for log ingestion, not alert forwarding. Thus, the built-in forwarding rule is the right configuration.

Answer

Configure the SIEM to pull alerts from Cortex XDR using a syslog collector with a severity filter.

Answer

Use the Cortex XDR API to query alerts with severity High or Critical and push them to the SIEM via a custom script.

Answer

Set up a Broker VM to collect all alerts and then filter them locally before forwarding to the SIEM.

Question 2

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

Accepted Answer

Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page. To trust self-signed certificates on a Broker VM, the administrator must upload the custom CA certificate bundle via the Broker VM management interface.

Answer

Add the target API IP address to the Broker VM local hosts file

Answer

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Answer

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Question 3

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

Accepted Answer

A Condition (or Decision) block that evaluates the sandbox verdict output. Conditional routing in playbooks is handled using Decision or Condition tasks to evaluate previous task outputs.

Answer

A Data Collection task pointing to the endpoint agent

Answer

A Post-Processing script executed directly on the Broker VM

Answer

A Manual Approval step without automated logic branching

Question 4

Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?

Accepted Answer

Settings > Configurations > Data Integration > Broker VM. Broker VM monitoring and status can be checked under Settings > Configurations > Data Integration > Broker VM.

Answer

Incidents > Response > Broker Status

Answer

Marketplace > Integrations > Instances

Answer

Endpoints > Management > Agent Status

Question 5

When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?

Accepted Answer

To uniquely identify a specific configuration and credential set for an integration. Integration instances allow administrators to configure multiple instances of the same integration with different parameters, each identified by a unique instance name.

Answer

To determine the operating system kernel executing the automation script

Answer

To define the encryption key used for secure payload transit

Answer

To specify the physical network interface the integration binds to

Question 6

An administrator is troubleshooting a Cortex XDR syslog integration where logs from a high-throughput network device are being dropped or delayed. The Broker VM resource utilization for CPU and memory is normal. Which underlying collector configuration setting should be adjusted to handle the high burst rate?

Accepted Answer

Increase the syslog collector worker threads and queue size parameters in the Broker VM configuration. Increasing the syslog collector worker threads and queue size parameters in the Broker VM configuration allows the collector to process more messages concurrently and buffer bursts, preventing drops or delays. This is the correct tuning when CPU and memory are normal, as the bottleneck is likely in the collector's processing capacity.

Answer

Switch the syslog transport from TCP to ICMP tunneling

Answer

Enable verbose kernel debugging on the Cortex XDR agent

Answer

Decrease the agent keep-alive interval to force faster handshakes

Question 7

An organization requires that logs ingested via the Cortex XDR Syslog Collector be secured using TLS encryption (Syslog-over-TLS). What must the administrator configure on the Broker VM to support this requirement?

Accepted Answer

Configure the syslog collector instance on the Broker VM with a valid SSL/TLS certificate and private key. To secure syslog ingestion with TLS, the Broker VM's syslog collector must be configured with a valid SSL/TLS certificate and private key. This enables the collector to accept encrypted syslog-over-TLS connections from sources. The certificate and key are used to establish the TLS session, ensuring confidentiality and integrity of the log data.

Answer

Install an external IPsec VPN tunnel between the syslog source and the Cortex XDR cloud tenant

Answer

Modify the Windows Registry keys on the domain controller

Answer

Configure a reverse proxy on the endpoint agent with port forwarding

Question 8

An administrator is configuring a Syslog Collector agent on Cortex XDR to ingest logs from a third-party firewall. Which log collection protocol and transport layer combination is natively supported by the Cortex XDR Collector for receiving unencrypted syslog messages?

Accepted Answer

Syslog over UDP and TCP. The Cortex XDR Collector natively supports receiving unencrypted syslog messages over both UDP and TCP. UDP is commonly used for syslog due to its low overhead, while TCP provides reliable delivery. This combination is standard for syslog ingestion in many security platforms.

Answer

Syslog over HTTP/HTTPS

Answer

Syslog over SSH tunneling

Answer

Syslog over FTP/SFTP

Question 9

When setting up data forwarding from Cortex XDR to a third-party SIEM using the Cortex XDR Data Forwarder, which protocol is commonly used to stream the logs?

Accepted Answer

HTTP/HTTPS or Syslog. Cortex XDR Data Forwarder typically streams logs to SIEMs using HTTPS or syslog protocols.

Answer

NetBIOS Name Service (NBNS)

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Remote Desktop Protocol (RDP)

Question 10

An administrator needs to ingest CEF (Common Event Format) logs from a third-party security device using the Broker VM. Which collector type must be enabled on the Broker VM configuration page in Cortex XDR?

Accepted Answer

Generic Syslog / CEF Collector. The Generic Syslog / CEF Collector is designed to ingest syslog messages in CEF format from third-party devices. Enabling this collector type on the Broker VM allows it to parse CEF logs and forward them to Cortex XDR. Other collector types are specific to cloud services or protocols and do not support generic CEF ingestion.

Answer

AWS CloudTrail App Collector

Answer

Office 365 Management Activity Collector

Answer

Active Directory WMI Collector

Question 11

An administrator has configured a new AWS CloudTrail integration via Broker VM to ingest cloud logs into Cortex XDR. However, no logs are appearing in the XDR database. Upon reviewing the Broker VM logs, the administrator notices an 'AccessDenied' error from AWS. What is the most likely root cause?

Accepted Answer

The IAM role or user credentials provided to the Broker VM lack permissions to read from the S3 bucket. AWS CloudTrail ingestion requires an IAM role with sufficient permissions to access the designated S3 bucket containing the logs.

Answer

The Cortex XDR agent license has expired for cloud log ingestion

Answer

The AWS region ID is misspelled in the local hosts configuration file

Answer

The Broker VM has insufficient RAM allocated to run the S3 polling daemon

Question 12

Which role is required within Cortex XDR for a user to configure API keys, data integration settings, and automation playbooks?

Accepted Answer

Account Admin or Security Administrator role. Configuring API keys, data integration settings, and automation playbooks requires elevated administrative privileges in Cortex XDR. The Account Admin or Security Administrator role grants the necessary permissions to manage tenant-wide integrations and automation, whereas analyst and viewer roles are read-only or investigation-focused.

Answer

Endpoint Viewer role

Answer

Standard User role

Answer

SOC Analyst Tier 1 role

Question 13

An automation playbook in Cortex XSOAR needs to execute a custom Python script that interacts with an internal legacy database not covered by existing Marketplace integrations. Which component should the administrator use to securely run this custom script?

Accepted Answer

A custom Python Integration running inside an isolated Docker container managed by the engine/server. Custom scripts and integrations in Cortex XSOAR execute within a Docker container environment managed by integration containers or custom Python scripts.

Answer

A local Windows batch script executed by the Cortex XDR endpoint agent

Answer

Direct execution via SSH on the Cortex XDR multi-tenant cloud backend

Answer

A direct SQL query string passed unencrypted through the Syslog collector port

Question 14

Where in the Cortex XDR web interface can an administrator generate API keys (API Key and Incident ID / Key) required for external integrations and scripts to authenticate with the Cortex XDR API?

Accepted Answer

Settings > Configurations > Integrations > API Keys. In the Cortex XDR web interface, API keys are generated under Settings > Configurations > Integrations > API Keys. This location provides both the API Key and the associated Incident ID/Key required for external scripts and integrations to authenticate with the Cortex XDR API. The API key acts as a credential for the API, while the Incident ID/Key is used for specific API operations related to incidents. This is the standard path for administrators to create and manage API access.

Answer

Marketplace > Settings > Credentials

Answer

Endpoints > Policy > Authentication

Answer

Incidents > Actions > Generate Key

Question 15

What is the primary function of the Cortex XDR 'Content Pack' in Marketplace?

Accepted Answer

To provide pre-packaged integrations, playbooks, dashboards, and automation building blocks. Content packs in Marketplace package pre-built integrations, playbooks, dashboards, and incident types.

Answer

To install local antivirus signatures directly onto endpoint file systems

Answer

To store encrypted backups of Cortex XDR database records

Answer

To compile raw C++ source code for custom endpoint isolation drivers